Vue Template Compiler, a crucial tool for Vue 2.0 development, has a new version, 2.7.3, succeeding the previous stable version, 2.7.2. Both versions serve the same core purpose: compiling Vue templates into render functions that the Vue runtime can understand and execute. This process is vital for building dynamic and interactive user interfaces.
While the core functionality remains consistent, there are distinctions between the two releases. Version 2.7.3 was released on July 6, 2022, and exhibits a slightly larger unpacked size of 592183 bytes, compared to version 2.7.2's 591635 bytes released a day before. The change in the package size could indicate bug fixes, performance improvements or very minor feature additions specifically for template compilation which users won't directly interact with. Both versions share the same dependencies, de-indent and he, used for code formatting and HTML entity encoding respectively. Both packages also specify the vue package with relative path in devDependencies.
Developers relying on Vue Template Compiler should consider upgrading to version 2.7.3, particularly if they've encountered issues that might have been addressed in this newer patch. The updates are generally focused on stability and subtle improvements that are crucial for a robust development cycle. Furthermore, staying updated with these minor versions ensures best compatibility for Vue 2 projects. Because of the small differences in unpacked size between the two versions a detailed impact of the changes should be expected from the official release notes.
All the vulnerabilities related to the version 2.7.3 of the package
vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)
A vulnerability has been discovered in vue-template-compiler, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code. Vue 2 has reached End-of-Life. This vulnerability has been patched in Vue 3.
